Half a year ago we delivered a security fix for Jenkins that had the potential to break the entire Jenkins UI. We needed to change how Jenkins, through the Stapler web framework, handled HTTP requests, tightening the rules around what requests would be processed by Jenkins. In the six months since, we didn’t receive notable reports of problems resulting from this change, and it’s thanks to...

Today we published a security advisory that mostly informs about issues in Jenkins plugins that have no fixes. What’s going on? The Jenkins security team triages incoming reports both to Jira and our non-public mailing list. Once we’ve determined it is a plugin not maintained by any Jenkins security team members, we try to inform the plugin maintainer about the issue, offering our help in developing, reviewing,...

As a software engineer, for many years I have used open source software (frameworks, libraries, tools…​) in the different companies I have worked at. However, I had never been able to engage in an open-source project as a contributor, until now. Since I made my first—​ridiculously simple—​commit into Jenkins, six months ago (in September, 2018), I have been attempting to contribute more to the Jenkins project. However, contributing...

Over the past three months, I have been mentoring two Outreachy interns, David and Latha, with my co-mentor, Jeff Thompson. Our project was to introduce a standardized way for creating an audit log of Jenkins and plugins using Apache Log4j Audit. While this type of feature is addressed by other existing plugins, there is no unifying way for plugins to contribute their own actions. This project provided...

Today Linux Foundation, along with CloudBees, Google, and a number of other companies, launched a new open-source software foundation called Continuous Delivery Foundation (CDF.) The CDF believes in the power of Continuous Delivery, and it aims to foster and sustain the ecosystem of open-source, vendor neutral projects. Jenkins contributors have decided that our project should join this new foundation. This discussion happened over a period...

This is a joint blog post prepared by the Java 11 Support Team: Adrien Lecharpentier, Ashton Treadway, Baptiste Mathus, Jenn Briden, Kevin Earls, María Isabel Vilacides, Mark Waite, Ramón León and Oleg Nenashev. We have worked hard for this and it’s now here. We are thrilled to announce full support for Java 11 in Jenkins starting from Jenkins 2.164 (released on Feb 10, 2019) and LTS...

On behalf of the Jenkins GSoC org team, I am happy to announce that the Jenkins project has been accepted to Google Summer of Code 2019. This year we invite students and mentors to join the Jenkins community and work together on enhancing the Jenkins ecosystem. Just to provide some numbers, this is the biggest GSoC ever, 206 organizations will participate in GSoC this year. And it will be hopefully...

The DevOps World | Jenkins World shuttle is ready for lift off once again. As usual, the sign of festivities looming begins with the Call for Speakers. Those who attended DevOps World | Jenkins World 2018 know that DevOps World | Jenkins World 2019 is coming back to San Francisco, and adding a stop in Europe - Lisbon, Portugal. Jenkins World USA | San Francisco...